Version:

Version:

Version:

Version:

Version:


Table of Contents

Hardware Acceleration

Optimizing NP6 performance by distributing traffic to XAUI links

On FortiGate units with NP6 processors, the FortiGate interfaces are switch ports that connect to the NP6 processors with XAUI links. Each NP6 processor has a 40-Gigabit bandwidth capacity. Traffic passes from the interfaces to each NP6 processor over four XAUI links. The four XAUI links each have a 10-Gigabit capacity for a total of 40 Gigabits.

On many FortiGate units with NP6 processors, the NP6 processors and the XAUI links are over-subscribed. Since the NP6 processors are connected by an Integrated Switch Fabric, you do not have control over how traffic is distributed to them. In fact traffic is distributed evenly by the ISF.

However, you can control how traffic is distributed to the XAUI links and you can optimize performance by distributing traffic evenly among the XAUI links. For example, if you have a very high amount of traffic passing between two networks, you can connect each network to interfaces connected to different XAUI links to distribute the traffic for each network to a different XAUI link.

Example: FortiGate 3200D

On the FortiGate 3200D (See FortiGate 3200D fast path architecture), there are 48 10-Gigabit interfaces that send and receive traffic for two NP6 processors over a total of eight 10-Gigabit XAUI links. Each XAUI link gets traffic from six 10-Gigabit FortiGate interfaces. The amount of traffic that the FortiGate 3200D can offload is limited by the number of NP6 processors and the number of XAUI links. You can optimize the amount of traffic that the FortiGate 3200D can process by distributing it evenly amount the XAUI links and the NP6 processors.

You can see the Ethernet interface, XAUI link, and NP6 configuration by entering the get hardware npu np6 port-list command. For the FortiGate 3200D the output is:

get hardware npu np6 port-list 
Chip   XAUI Ports   Max   Cross-chip 
                    Speed offloading 
------ ---- ------- ----- ---------- 
np6_0  0    port1   10G   Yes        
       0    port5   10G   Yes        
       0    port10  10G   Yes        
       0    port13  10G   Yes        
       0    port17  10G   Yes        
       0    port22  10G   Yes        
       1    port2   10G   Yes        
       1    port6   10G   Yes        
       1    port9   10G   Yes        
       1    port14  10G   Yes        
       1    port18  10G   Yes        
       1    port21  10G   Yes        
       2    port3   10G   Yes        
       2    port7   10G   Yes        
       2    port12  10G   Yes        
       2    port15  10G   Yes        
       2    port19  10G   Yes        
       2    port24  10G   Yes        
       3    port4   10G   Yes        
       3    port8   10G   Yes        
       3    port11  10G   Yes        
       3    port16  10G   Yes        
       3    port20  10G   Yes        
       3    port23  10G   Yes        
------ ---- ------- ----- ---------- 
np6_1  0    port26  10G   Yes        
       0    port29  10G   Yes        
       0    port33  10G   Yes        
       0    port37  10G   Yes        
       0    port41  10G   Yes        
       0    port45  10G   Yes        
       1    port25  10G   Yes        
       1    port30  10G   Yes        
       1    port34  10G   Yes        
       1    port38  10G   Yes        
       1    port42  10G   Yes        
       1    port46  10G   Yes        
       2    port28  10G   Yes        
       2    port31  10G   Yes        
       2    port35  10G   Yes        
       2    port39  10G   Yes        
       2    port43  10G   Yes        
       2    port47  10G   Yes        
       3    port27  10G   Yes        
       3    port32  10G   Yes        
       3    port36  10G   Yes        
       3    port40  10G   Yes        
       3    port44  10G   Yes        
       3    port48  10G   Yes        
------ ---- ------- ----- ----------

In this command output you can see that each NP6 has for four XAUI links (0 to 3) and that each XAUI link is connected to six 10-gigabit Ethernet interfaces. To optimize throughput you should keep the amount of traffic being processed by each XAUI port to under 10 Gbps. So for example, if you want to offload traffic from four 10-gigabit networks you can connect these networks to Ethernet interfaces 1, 2, 3 and 4. This distributes the traffic from each 10-Gigabit network to a different XAUI link. Also, if you wanted to offload traffic from four more 10-Gigabit networks you could connect them to Ethernet ports 26, 25, 28, and 27. As a result each 10-Gigabit network would be connected to a different XAUI link.

Example FortiGate 3300E

On the FortiGate 3300E (See FortiGate 3300E and 3301E fast path architecture), there are 34 data interfaces of various speeds that send and receive traffic for four NP6 processors over a total of sixteen 10-Gigabit XAUI links. The amount of traffic that the FortiGate 3300E can offload is limited by the number of NP6 processors and the number of XAUI links. You can optimize the amount of traffic that the FortiGate 3300E can process by distributing it evenly amount the XAUI links and the NP6 processors.

You can see the FortiGate 3300E Ethernet interface, XAUI link, and NP6 configuration by entering the get hardware npu np6 port-list command. For the FortiGate 3300E the output is:

get hardware npu np6 port-list
Chip   XAUI Ports            Max   Cross-chip 
                             Speed offloading 
------ ---- -------          ----- ---------- 
np6_0  0    port1            1G    Yes        
       0    port14           10G   Yes        
       1    port2            1G    Yes        
       1    port15           10G   Yes        
       2    port3            1G    Yes        
       2    port16           10G   Yes        
       3    port13           10G   Yes        
       0-3  port17           25G   Yes        
       0-3  port31           40G   Yes        
------ ---- -------          ----- ---------- 
np6_1  0    port4            1G    Yes        
       1    port5            1G    Yes        
       2    port6            1G    Yes        
       3    
       0-3  port18           25G   Yes        
       0-3  port19           25G   Yes        
       0-3  port20           25G   Yes        
       0-3  port24           25G   Yes        
       0-3  port23           25G   Yes        
       0-3  port32           40G   Yes        
------ ---- -------          ----- ---------- 
np6_2  0    port7            1G    Yes        
       1    port8            1G    Yes        
       2    port9            1G    Yes        
       3    
       0-3  port22           25G   Yes        
       0-3  port21           25G   Yes        
       0-3  port26           25G   Yes        
       0-3  port25           25G   Yes        
       0-3  port28           25G   Yes        
       0-3  port33           40G   Yes        
------ ---- -------          ----- ---------- 
np6_3  0    port10           1G    Yes        
       1    port11           1G    Yes        
       2    port12           1G    Yes        
       2    port29           10G   Yes        
       3    port30           10G   Yes        
       0-3  port27           25G   Yes        
       0-3  port34           40G   Yes        
------ ---- -------          ----- ---------- 

In this command output you can see that each NP6 has four XAUI links (0 to 3) and the mapping between XAUI ports and interfaces is different for each NP6 processor.

NP6_0 has the following XAUI mapping:

  • port1 (1G) and port14 (10G) are connected to XAUI link 0.
  • port2 (1G) and port15 (10G) are connected to XAUI link 1.
  • port3 (1G) and port16 (10G) are connected to XAUI link 2.
  • port13 (10G) is connected to XAUI link 3.
  • port17 (25G) and port31 (40G) are connect to all four of the XAUI links (0-3).

The interfaces connected to NP6_0 have a total capacity of 108G, but NP6_0 has total capacity of 40G. For optimal performance, no more than 40G of this capacity should be used or performance will be affected. For example, if you connect port31 to a busy 40G network you should avoid using any of the other ports connected to NP6_0. If you connect port17 to a 25G network, you can also connect one or two 10G interfaces (for example, port14 and 15). You can connect port13, port14, port15, and port16 to four 10G networks if you avoid using any of the other interfaces connected to NP6_0.

Optimizing NP6 performance by distributing traffic to XAUI links

On FortiGate units with NP6 processors, the FortiGate interfaces are switch ports that connect to the NP6 processors with XAUI links. Each NP6 processor has a 40-Gigabit bandwidth capacity. Traffic passes from the interfaces to each NP6 processor over four XAUI links. The four XAUI links each have a 10-Gigabit capacity for a total of 40 Gigabits.

On many FortiGate units with NP6 processors, the NP6 processors and the XAUI links are over-subscribed. Since the NP6 processors are connected by an Integrated Switch Fabric, you do not have control over how traffic is distributed to them. In fact traffic is distributed evenly by the ISF.

However, you can control how traffic is distributed to the XAUI links and you can optimize performance by distributing traffic evenly among the XAUI links. For example, if you have a very high amount of traffic passing between two networks, you can connect each network to interfaces connected to different XAUI links to distribute the traffic for each network to a different XAUI link.

Example: FortiGate 3200D

On the FortiGate 3200D (See FortiGate 3200D fast path architecture), there are 48 10-Gigabit interfaces that send and receive traffic for two NP6 processors over a total of eight 10-Gigabit XAUI links. Each XAUI link gets traffic from six 10-Gigabit FortiGate interfaces. The amount of traffic that the FortiGate 3200D can offload is limited by the number of NP6 processors and the number of XAUI links. You can optimize the amount of traffic that the FortiGate 3200D can process by distributing it evenly amount the XAUI links and the NP6 processors.

You can see the Ethernet interface, XAUI link, and NP6 configuration by entering the get hardware npu np6 port-list command. For the FortiGate 3200D the output is:

get hardware npu np6 port-list 
Chip   XAUI Ports   Max   Cross-chip 
                    Speed offloading 
------ ---- ------- ----- ---------- 
np6_0  0    port1   10G   Yes        
       0    port5   10G   Yes        
       0    port10  10G   Yes        
       0    port13  10G   Yes        
       0    port17  10G   Yes        
       0    port22  10G   Yes        
       1    port2   10G   Yes        
       1    port6   10G   Yes        
       1    port9   10G   Yes        
       1    port14  10G   Yes        
       1    port18  10G   Yes        
       1    port21  10G   Yes        
       2    port3   10G   Yes        
       2    port7   10G   Yes        
       2    port12  10G   Yes        
       2    port15  10G   Yes        
       2    port19  10G   Yes        
       2    port24  10G   Yes        
       3    port4   10G   Yes        
       3    port8   10G   Yes        
       3    port11  10G   Yes        
       3    port16  10G   Yes        
       3    port20  10G   Yes        
       3    port23  10G   Yes        
------ ---- ------- ----- ---------- 
np6_1  0    port26  10G   Yes        
       0    port29  10G   Yes        
       0    port33  10G   Yes        
       0    port37  10G   Yes        
       0    port41  10G   Yes        
       0    port45  10G   Yes        
       1    port25  10G   Yes        
       1    port30  10G   Yes        
       1    port34  10G   Yes        
       1    port38  10G   Yes        
       1    port42  10G   Yes        
       1    port46  10G   Yes        
       2    port28  10G   Yes        
       2    port31  10G   Yes        
       2    port35  10G   Yes        
       2    port39  10G   Yes        
       2    port43  10G   Yes        
       2    port47  10G   Yes        
       3    port27  10G   Yes        
       3    port32  10G   Yes        
       3    port36  10G   Yes        
       3    port40  10G   Yes        
       3    port44  10G   Yes        
       3    port48  10G   Yes        
------ ---- ------- ----- ----------

In this command output you can see that each NP6 has for four XAUI links (0 to 3) and that each XAUI link is connected to six 10-gigabit Ethernet interfaces. To optimize throughput you should keep the amount of traffic being processed by each XAUI port to under 10 Gbps. So for example, if you want to offload traffic from four 10-gigabit networks you can connect these networks to Ethernet interfaces 1, 2, 3 and 4. This distributes the traffic from each 10-Gigabit network to a different XAUI link. Also, if you wanted to offload traffic from four more 10-Gigabit networks you could connect them to Ethernet ports 26, 25, 28, and 27. As a result each 10-Gigabit network would be connected to a different XAUI link.

Example FortiGate 3300E

On the FortiGate 3300E (See FortiGate 3300E and 3301E fast path architecture), there are 34 data interfaces of various speeds that send and receive traffic for four NP6 processors over a total of sixteen 10-Gigabit XAUI links. The amount of traffic that the FortiGate 3300E can offload is limited by the number of NP6 processors and the number of XAUI links. You can optimize the amount of traffic that the FortiGate 3300E can process by distributing it evenly amount the XAUI links and the NP6 processors.

You can see the FortiGate 3300E Ethernet interface, XAUI link, and NP6 configuration by entering the get hardware npu np6 port-list command. For the FortiGate 3300E the output is:

get hardware npu np6 port-list
Chip   XAUI Ports            Max   Cross-chip 
                             Speed offloading 
------ ---- -------          ----- ---------- 
np6_0  0    port1            1G    Yes        
       0    port14           10G   Yes        
       1    port2            1G    Yes        
       1    port15           10G   Yes        
       2    port3            1G    Yes        
       2    port16           10G   Yes        
       3    port13           10G   Yes        
       0-3  port17           25G   Yes        
       0-3  port31           40G   Yes        
------ ---- -------          ----- ---------- 
np6_1  0    port4            1G    Yes        
       1    port5            1G    Yes        
       2    port6            1G    Yes        
       3    
       0-3  port18           25G   Yes        
       0-3  port19           25G   Yes        
       0-3  port20           25G   Yes        
       0-3  port24           25G   Yes        
       0-3  port23           25G   Yes        
       0-3  port32           40G   Yes        
------ ---- -------          ----- ---------- 
np6_2  0    port7            1G    Yes        
       1    port8            1G    Yes        
       2    port9            1G    Yes        
       3    
       0-3  port22           25G   Yes        
       0-3  port21           25G   Yes        
       0-3  port26           25G   Yes        
       0-3  port25           25G   Yes        
       0-3  port28           25G   Yes        
       0-3  port33           40G   Yes        
------ ---- -------          ----- ---------- 
np6_3  0    port10           1G    Yes        
       1    port11           1G    Yes        
       2    port12           1G    Yes        
       2    port29           10G   Yes        
       3    port30           10G   Yes        
       0-3  port27           25G   Yes        
       0-3  port34           40G   Yes        
------ ---- -------          ----- ---------- 

In this command output you can see that each NP6 has four XAUI links (0 to 3) and the mapping between XAUI ports and interfaces is different for each NP6 processor.

NP6_0 has the following XAUI mapping:

  • port1 (1G) and port14 (10G) are connected to XAUI link 0.
  • port2 (1G) and port15 (10G) are connected to XAUI link 1.
  • port3 (1G) and port16 (10G) are connected to XAUI link 2.
  • port13 (10G) is connected to XAUI link 3.
  • port17 (25G) and port31 (40G) are connect to all four of the XAUI links (0-3).

The interfaces connected to NP6_0 have a total capacity of 108G, but NP6_0 has total capacity of 40G. For optimal performance, no more than 40G of this capacity should be used or performance will be affected. For example, if you connect port31 to a busy 40G network you should avoid using any of the other ports connected to NP6_0. If you connect port17 to a 25G network, you can also connect one or two 10G interfaces (for example, port14 and 15). You can connect port13, port14, port15, and port16 to four 10G networks if you avoid using any of the other interfaces connected to NP6_0.